Mini-BidTemplate

Authorized User Instructions

How to Use this Template

 Text Fields highlighted in grey must be updated with information relevant to your project.
 Explanatory comments are in (parenthesis) and italic text and should be removed.

Tailor this template to meet your needs. Some sections of this template may not be
relevant to all Authorized Users. Those sections may be changed or removed.
Remove explanatory comments as you go along. Where you decide to omit a section,
you might keep the header, but insert a comment saying why you omitted the data.

Delete this page prior to distribution.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
 INSERT AUTHORIZED USER NAME
INSERT AUTHORIZED USER STREET ADDRESS
INSERT AUTHORIZED USER CITY, STATE, ZIP CODE
MINI-BID # INSERT MINI-BID REFERENCE NUMBER
CYBER SECURITY RISK ASSESSMENT PROJECT
CONTRACT CATEGORY: PROJECT BASED INFORMATION TECHNOLOGY CONSULTING SERVICES
GROUP: 73600 AWARD NUMBER:22772
FIXED-PRICE BASIS ONLY
Insert Lot No.
DESIGNATED CONTACTS

Primary Contact: Insert First and Last Name Secondary Contact: Insert First and Last Name

E-mail address: Insert E-Mail Address E-mail address: Insert E-Mail Address
Authorized User shall indicate if Procurement Lobbying Law/Restricted Period is in effect : Yes No
Where Procurement Lobbying Law is deemed applicable by the Authorized User, by signing, Contractor affirms that it understands
and agrees to comply with the Authorized User’s policies and procedures relative to permissible contacts.  Information may be
accessed at:  Procurement Lobbying:
http://www.ogs.ny.gov/aboutOgs/regulations/defaultAdvisoryCouncil.html)

If different than above, please mail the signed and notarized original of this document and any completed Attachment(s) to the following
address:

Insert First and Last Name

INSERT AUTHORIZED USER NAME
INSERT AUTHORIZED USER STREET ADDRESS
INSERT AUTHORIZED USER CITY, STATE, ZIP CODE

CONTRACT TERM, EXTENSIONS AND NO COST CHANGE REQUESTS/ENHANCEMENTS

(The maximum term for any Authorized User Agreement isthree (3) years from the beginning of the engagement. The starting date for
each Authorized User’s project will vary according to the date of the Mini-Bid award. An Authorized User Agreement that is fully
executed prior to the expiration of the OGS Centralized Contract shall survive the expiration date of the OGS Centralized Contract, as
defined in the OGS Centralized Contract.

An Authorized User and Contractor are encouraged to plan accordingly and make allowances for Project Scope Changes and
Change Requests.

NO COST CHANGE REQUEST: An Authorized User may reasonably amend a fixed-price deliverable, provided the amendment
does not materially change the scope of the Deliverable, and it shall not result in a cost increase.

ENHANCEMENT BUDGET: An Authorized User may include an enhancement budget in the Mini-Bid.Enhancements mean additional
functionality and additional Deliverables unknown to the Authorized User at the time of Mini-Bid release.As such, an Authorized User’s
project is permitted to include an Enhancement budget, as included in the Mini-Bid (up to 10%). The total cost including the
Enhancement budget may not exceed the Lot parameters from which the award was made. An Authorized User shall use the
Enhancement Request Template to reflect such modifications.)
Tentative Start DateEnter DatethroughEnter Date
Authorized User’s Maximum Enhancement Budget Allowable Percentage      %
This figure is applied after the negotiations with Tentative Awardee and should not be included with the Contractor’s
submission in response to this document.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
MWBE GOALS, UTILIZATION AND STAFFING PLANS
(NYS Executive Agencies must follow internal policies on establishing MWBE goals, as follows. Other Authorized Users should
follow their own internal policies according to Article 15A of the Executive Law. Please see http://www.esd.ny.gov/MWBE.html for
more information. Other Authorized Users may wish to add MWBE utilization goals as they see fit. Please note that the following is
based on the language included in the Periodic Recruitment Solicitation Document. Should an Authorized User wish, they are
permitted to insert their own MWBE language in this section.)

CONTRACTOR REQUIREMENTS AND PROCEDURES FOR BUSINESS PARTICIPATION OPPORTUNITIES FOR

NEW YORK STATE CERTIFIED MINORITY- AND WOMEN-OWNED BUSINESS ENTERPRISES AND EQUAL
EMPLOYMENT OPPORTUNITIES FOR MINORITY GROUP MEMBERS AND WOMEN ON NEW YORK STATE
AGENCY AND AUTHORITY (as defined in New York State Executive Law §310 and hereinafter referred to as “State
Agency”) MINI-BIDS

POLICY STATEMENT

The FILL IN STATE AGENCY NAMEas part of its responsibility, recognizes the need to promote the employment of
minority group members and women and to ensure that certified minority- and women-owned business enterprises
have opportunities for maximum feasible participation in the performance of State Agency Authorized User
Agreements.

In 2006, the State of New York commissioned a disparity study to evaluate whether minority- and women-owned
business enterprises had a full and fair opportunity to participate in State contracting. The findings of the study were
published on April 29, 2010, under the title "The State of Minority- and Women-Owned Business Enterprises: Evidence
from New York" (the “Disparity Study”). The report found evidence of statistically significant disparities between the
level of participation of minority- and women-owned business enterprises in State procurement contracting versus the
number of minority- and women-owned business enterprises that were ready, willing and able to participate in State
procurements. As a result of these findings, the Disparity Study made recommendations concerning the
implementation and operation of the statewide certified minority- and women-owned business enterprises program.
The recommendations from the Disparity Study culminated in the enactment and the implementation of New York State
Executive Law Article 15-A, which requires, among other things, thatFILL IN STATE AGENCY NAMEestablish goals
for maximum feasible participation of New York State certified minority- and women–owned business enterprises
(“MWBEs”) and the employment of minority groups members and women in the performance of New York State
Contracts and State Agency Authorized User Agreements.

EQUAL EMPLOYMENT OPPORTUNITY REQUIREMENTS

By submission of response to this Mini-Bid, the Contractor agrees with all of the terms and conditions of Appendix A
including Clause 12 - Equal Employment Opportunities for Minorities and Women. The Contractor is required to ensure
that it and any subcontractors awarded a subcontract over $25,000 for the construction, demolition, replacement, major
repair, renovation, planning or design of real property and improvements thereon (the “Work”) except where the Work is
for the beneficial use of the Contractor, shall undertake or continue programs to ensure that minority group members
and women are afforded equal employment opportunities without discrimination because of race, creed, color, national
origin, sex, age, disability or marital status. For these purposes, equal opportunity shall apply in the areas of
recruitment, employment, job assignment, promotion, upgrading, demotion, transfer, layoff, termination, and rates of
pay or other forms of compensation. This requirement does not apply to: (i) work, goods, or services unrelated to the
Contract; or (ii) employment outside New York State.

The Bidder further agrees to submit with the Mini-Bid response, a staffing plan on Form FILL IN STATE AGENCY'S
FORM NUMBERidentifying the anticipated work force to be utilized on the State Agency Authorized User
Agreementand if awarded a State Agency Authorized User Agreement, will submit toFILL IN STATE AGENCY NAME
upon request, a workforce utilization report on form FILL IN STATE AGENCY'S FORM NUMBER, identifying the
workforce actually utilized on the State Agency Authorized User Agreement,if known..

Further, pursuant to Article 15 of the Executive Law (also known as the Human Rights Law) and all other State and
federal statutory and constitutional non-discrimination provisions, the Contractor and sub-contractors will not
discriminate against any employee or applicant for employment because of race, creed (religion), color, sex (including
gender expression), national origin, sexual orientation, military status, age, disability, predisposing genetic
characteristic, marital status or domestic violence victim status, and shall also follow the requirements of the Human
Rights Law with regard to non-discrimination on the basis of prior criminal conviction and prior arrest.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
BUSINESS PARTICIPATION OPPORTUNITIES FOR NEW YORK STATE CERTIFIED MINORITY- AND WOMEN-
OWNED BUSINESS ENTERPRISES (MWBEs)

For purposes of this State Agency Authorized User Agreement, FILL IN STATE AGENCY NAMEhereby establishes a
goal of MBE % for minority-owned business enterprises (MBEs) participation andWBE %for women-owned business
enterprises (WBEs) participation (collectively referred to as MWBEs) for a total State Agency Authorized User
Agreement MWBE goal of (TOTAL %OR GREATER). The total State Agency Authorized User Agreement goal can be
obtained by utilizing any combination of MBE and /or WBE participation for subcontracting and supplies acquired under
this State Agency Authorized User Agreement. The directory of New York State Certified MWBEs can be viewed at:
https://ny.newnycontracts.com/frontend/diversityusers.asp .

Pursuant to 5 NYCRR § 142.8, a Contractor must document good faith efforts to provide meaningful participation by
MWBEs as subcontractors or suppliers in the performance of this State Agency Authorized User Agreement and
ensure that the MWBEs utilized under the State Agency Authorized User Agreement perform commercially useful
functions. Contractor agrees that FILL IN STATE AGENCY NAMEmay withhold payment pending receipt of the
required MWBE documentation.

Pursuant to 5 NYCRR § 140.1(f), a MWBE performs a commercially useful function when it is responsible for execution
of the work of the State Agency Authorized User Agreement and is carrying out its responsibilities by actually
performing, managing, and supervising the work involved. To perform a commercially useful function, a MWBE must ,
where applicable and in accordance with any State Agency specifications, also be responsible, with respect to
materials and supplies used on the State Agency Authorized User Agreement, for ordering and negotiating price,
determining quality and quantity and installing. A MWBE does not perform a commercially useful function if its role
adds no substantive value and is limited to that of an extra participant in a transaction, State Agency Authorized User
Agreement, or project through which funds are passed in order to obtain the appearance of participation. FILL IN
STATE AGENCY NAMEwill assess whether a MWBE is performing a commercially useful function by considering the
following:
(1) the amount of work subcontracted;
(2) industry practices;
(3) whether the amount the MWBE is to be paid under the State Agency Authorized User Agreement is commensurate
with the work it is to perform;
(4) the credit claimed towards MWBE utilization goals for the performance of the work by the MWBE; and
(5) any other relevant factors.

In accordance with 5 NYCRR §142.13, Contractor acknowledges that if it is found to have willfully and intentionally
failed to comply with the MWBE participation goals set forth in the State Agency Authorized User Agreement, such
finding constitutes a breach of the State Agency Authorized User Agreement and FILL IN STATE AGENCY NAMEmay
withhold payment from the Contractor as liquidated damages. Such liquidated damages shall be calculated as an
amount equaling the difference between: (1) all sums identified for payment to MWBEs had the Contractor achieved the
State Agency Authorized User Agreement MWBE goals; and (2) all sums actually paid to MWBEs for work performed
or materials supplied under the State Agency Authorized User Agreement.

By submitting a Mini-Bid response, Contractor agrees to submit the following documents and information as evidence
of compliance with the foregoing:

A. Contractors are required to submit a Utilization Plan on Form FILL IN STATE AGENCY'S FORM NUMBER with the
Mini-Bid response. The Utilization Plan shall list the MWBEs the Contractor intends to use to perform the State Agency
Authorized User Agreement, a description of the Commercially Useful Function the Contractor intends the MWBE to
perform to meet the goals on the State Agency Authorized User Agreement, the estimated or, if known, actual dollar
amounts to be paid to a MWBE and performance dates of each component of a State Agency Authorized User
Agreement that the Contractor intends to be performed by a MWBE. By signing the Utilization Plan, the Contractor
acknowledges that the utilization of MWBEs that do not perform commercially useful functions may not be counted as
meeting the MWBE goals of the State Agency Authorized User Agreement; and, that making false representations or
including information evidencing a lack of good faith as part of, or in conjunction with, the submission of a Utilization
Plan is prohibited by law and may result in penalties including, but not limited to, termination of a State Agency
Authorized User Agreement for cause, loss of eligibility to submit future bids, and/or withholding of payments. Any
modifications or changes to the agreed participation by NYS certified MWBEs after the Award of the State Agency
Authorized User Agreement and during the term of the State Agency Authorized User Agreement must be reported on
a revised MWBE Utilization Plan and submitted to FILL IN STATE AGENCY NAME.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
B. FILL IN STATE AGENCY NAMEwill review the submitted MWBE Utilization Plan and advise the Contractor of FILL
IN STATE AGENCY NAME acceptance or issue a notice of deficiency within twenty (20) days of receipt.

C. If a notice of deficiency is issued; Contractor agrees that it shall respond to the notice of deficiency, within seven (7)
business days of receipt, by submitting toFILL IN STATE AGENCY NAME a written remedy in response to the notice
of deficiency. If the written remedy that is submitted is not timely or is found by FILL IN STATE AGENCY'S FORM
NUMBER to be inadequate,FILL IN STATE AGENCY NAME shall notify the Contractor and direct the Contractor to
submit, within five (5) business days of notification by FILL IN STATE AGENCY NAME, a request for a partial or total
waiver of MWBE participation goals on Form FILL IN STATE AGENCY'S FORM NUMBER. Failure to file the waiver
form in a timely manner may be grounds for disqualification of the Mini-Bid response.

D. FILL IN STATE AGENCY NAMEmay disqualify a Contractor as being non-responsive under the following
circumstances:

a) If a Contractor fails to submit a MWBE Utilization Plan;

b) If a Contractor fails to submit a written remedy to a notice of deficiency;
c) If a Contractor fails to submit a request for waiver; or
d) If FILL IN STATE AGENCY NAMEdetermines that the Contractor has failed to document good faith efforts.

A Contractor who documents good faith efforts to meet the goal requirements may submit a request for a partial or total
waiver on Form FILL IN STATE AGENCY NAME at the same time it submits its MWBE Utilization Plan. If a request for
waiver is submitted with the MWBE Utilization Plan and is not accepted by FILL IN STATE AGENCY NAMEat that
time, the provisions of clauses B-D above, will apply.

Contractor shall attempt to utilize, in good faith, any MBE or WBE identified within its MWBE Utilization Plan, during the
performance of the State Agency Authorized User Agreement. Requests for a partial or total waiver of established goal
requirements made subsequent to the Award of the State Agency Authorized User Agreement may be made at any
time during the term of the State Agency Authorized User Agreement to FILL IN STATE AGENCY NAME, but must be
made no later than prior to the submission of a request for final payment on the State Agency Authorized User
Agreement.

E. Monthly MWBE Contractor Compliance Report

Contractors are required to report Monthly MWBE Contractor Compliance to FILL IN STATE AGENCY NAME during
the term of the State Agency Authorized User Agreement for the preceding month’s activity, documenting progress
made towards achievement of the State Agency Authorized User Agreement MWBE goals. FILL IN STATE AGENCY
NAMErequests that all Contractors use the New York State Contract System (NYSCS) to report subcontractor and
supplier payments made by Contractor to MWBEs performing commercially useful functions under the State Agency
Authorized User Agreement. The NYSCS may be accessed at https://ny.newnycontracts.com/. This is a New York
State-based system that all State agencies and authorities will be implementing to ensure uniform contract compliance
reporting throughout New York State. If a Contractor is unable to report MWBE Contractor Compliance via the NYSCS,
Contractor must submit a Monthly MWBE Contractor Compliance Report on Form FILL IN STATE AGENCY'S FORM
NUMBER to FILL IN STATE AGENCY NAME. More information about the NYSCS will be provided if Contractor is
awarded a State Agency Authorized User Agreement.

Please Note: Failure to comply with the foregoing requirements may result in a finding of non-responsiveness, non-
responsibility and/or a breach of the State Agency Authorized User Agreement, leading to the withholding of funds,
suspension or termination of the State Agency Authorized User Agreement or such other actions or enforcement
proceedings as allowed by the State Agency Authorized User Agreement.

ALL FORMS ARE AVAILABLE AT: FILL IN STATE AGENCY'S LOCATION OF MWBE FORMS.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
BEST VALUE AWARD METHODOLOGY
(The OGS Centralized Contract requires that a Mini-Bid be completed and an award madeon the basis of “best value”.
Thus, an Authorized User Agreement award must be made to the Contractor who offers the best value solution. State
Finance Law § 163(4)(d) mandates that a contract for services (including technology) be awarded on the basis of best
value which takes into consideration cost as well as technical or non-cost factors. For certain service and technology
procurements, best value can be equated to lowest price, where all requirements have been met by the Contractor. The
evaluation weight assigned to the Technical evaluation shall not exceed 70% of the total score, and Cost evaluation
shall be no less than 30% of the total score. The evaluation ratio MUST BE STATED below.

If the Authorized User is subject to the requirements of the State Finance Law, State Finance Law Section 163(1)(j)
allows the inclusion of a quantitative factor for offerers that are small businesses or certified minority- or women-owned
business enterprises (MWBEs) as defined in subdivisions one, seven, fifteen and twenty of section three hundred ten of
the Executive Lawor service-disabled veteran-owned business enterprises (SDVOBE) as defined in subdivision one
of section three hundred sixty-nine-h of the executive law . It is recommended that up to 5% of the total technical
evaluation scale be awarded to a Proposer who meets one of these criteria.
In addition, if the Authorized User includes a quantitative factor in its evaluation, as part of the Mini-Bid process it must
obtain a self-certification from each Contractor indicating whether such Contractor is a small business pursuant to
Executive Law Section 310(20). The Authorized User must use the directory of New York State Certified MWBEs to
verify a Contractor’s status as a MWBE.

Authorized User may choose to provide additional Technical evaluation point components for the Contractor to provide
more focused proposals(e.g. 5% Key personnel interviews )
An award will be made to the Contractor who offers the best value solution.
Evaluation Weights:
Technical*: Insert Value (up to 70%) Financial/Cost: Insert Value (30-100%)
MWBE/SBE/SDVOBETechnical evaluation weight: Insert Value (up to 5%)
* indicate pass/fail when Financial is 100%
The total price quoted/negotiated will be a fixed-price for the term of the Authorized User Agreement. Prices will
remain firm for the entire Project duration.
     

MINI-BID PROPOSAL VALIDITY

All Contractor responses to Authorized User Mini-Bids must remain open and valid for at least 60 days from the Mini-
Bid opening date, unless the time for awarding the Authorized User Agreement is extended by mutual consent of the
Authorized User and the Contractor. A Contractor’s Mini-Bid response shall continue to remain an effective offer, firm
and irrevocable, subsequent to such 60 day period until either tentative award of the Authorized User Agreement by the
Authorized User is made or withdrawal of the Contractor Submission in writing by the Contractor. Tentative award of
the Authorized User Agreementshall consist of written notice to that effect by an Authorized User to a successful
Contractor, who shall thereupon be obligated to execute a formal Authorized User Agreement.

     

INTRODUCTION
(An Authorized User may use this section to introduce their organization to the Contractor pool. The introduction should be kept brief
and contain the information in the box below.)
This Mini-Bid is being distributed to the Contractors awarded under LotINSERT LOT NO.toacquire Project Based
Information Technology (IT) Consulting Services for INSERT AUTHORIZED USER NAME, anAuthorized User of OGS
Centralized ContractAward 22772 on a fixed-price basis.
 The purpose of this Mini-Bid is to obtain Proposals for a CYBER SECURITY ASSESSMENT PROJECTas detailed in
this document and any attachments(s) that may be included.
 Responses will only be accepted from Contractors listed under Award #22772, Lot # INSERT LOT NO..
 Responses which include pricing in excess of the “maximum Not-To-Exceed price” must be rejected by the
Authorized User.
     

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
AUTHORIZED USER PROCUREMENT RIGHTS
(An Authorized User should use this section to identify any additional reserved rights that they wish to include in order to provide
additional protections. Additional rights are those beyond the rights included in the OGS Centralized Contract.)

KEY EVENTS AND DATES

(An Authorized User should use this section to identify all dates and times associated with this Mini-Bid.There may be additional key
events the Authorized User may wishto add. Please take into consideration the level of complexity associated with the procurement
and allow sufficient time in the schedule included in this section to permit Contractors to prepare and submit anthorough response.)
Minimum Time Frames from Mini-Bid Release to Bid Opening are as follows:
 Lot 1 Mini-Bids: Five (5) Business Days
 Lot 2 Mini-Bids: Ten (10) Business Days
 Lot 3 Mini-Bids : Fifteen (15) Business Days

Event Date Time

Mini-Bid Release Enter Date Enter Time
Pre-Bid Conference Enter Date Enter Time
Contractor Question Period End Enter Date Enter Time
Authorized User Answer Issuance Deadline Enter Date Enter Time
Intent to Bid Deadline (if included, mandatory or optional
Enter Date Enter Time
at Authorized User’s discretion)
Bid Opening / Mini-Bid ResponseDue Date Enter Date Enter Time
Please note: INSERT AUTHORIZED USER NAMEwill not accept any Mini-Bid responses received after [Enter Day, Date
and Time Bids are Due].

PRE-BID CONFERENCE
(It is up to the Authorized User to decide if a Pre-Bid Conference will be held. If a Pre-Bid Conference is planned the Authorized
User must enter the details for the Pre-Bid Conference in the Mini-Bid. Please include details such as: Date, Time and Location of
the conference; state if participation is mandatory or optional for Contractors; how to register; any requirements for advanced
submission of questions in writing; and any building access requirements.)
Not Applicable

INTENT TO BID
(Withthe release of the Mini-Bid to all Contractors in the appropriate Lot, an Authorized User may request that Contractors submit a
notice of their Intent to Bid. If requested, a deadline date for the Intent to Bid submission must be included in the Key Events and
Dates section.Submission of the Intent to Bid may be mandatory or optional at the Authorized User’s discretion. Contractors that
submit an Intent to Bid are not required to submit a response to a Mini-Bid.)
Not Applicable

DOWNSTREAM PROHIBITION
(Any and all work from this Mini-Bid that involves developing specifications, establishing a base for other applications or otherwise
gaining information that would give a Contractor an unfair competitive advantage in a future procurement may result in the
Contractor being precluded from further work (downstream prohibition) due to conflicts of interest. Authorized User shall provide
notification of any downstream prohibitions known at the time the Mini-Bid is released. It is in the interest of the Authorized User and
the Contractor to explore these issues during the pre-award negotiations and review as the project progresses. See State Finance
Law section 163-a and section 163 (2) for additional information on the statutory prohibitions. Non-State agency Authorized Users
may have additional statutory prohibitions.)
If the services being procured leads to remediation services, a Contractor who has been involved in the development of
the requirements for future statements of work may be precluded from bidding on those future services. The
Governmental Entity reserves the right to make the final determination as to whether a Contractor will be precluded or
disqualified pursuant to this paragraph from bidding on future related projects.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
 CYBER SECURITY ASSESSMENT PROJECT
1. PROJECT OVERVIEW
(Provide a brief overview of the project. Much of this information may be extracted from existing documents
such as Project Charter, Business Case, etc.Fields may be modified or updated as required.)
1.1 PROJECTBACKGROUND
(Please provide Contractors with a short summary of the project’s history and proposed approach, such as:
 Short statement of the business need and problem to be resolved
 Time line or review of major dates in the project development process
 Authorized User organizational units and key personnel involved in advancing the project
 Alternative solutions or implementation strategies evaluated )
Utilizing the NYS Risk Framework (based on NIST standard), this project will assess the Government
Entity’scurrentsecurity controls. Contractor will document the current-state baseline IT environment as it relates to
security, including the people, processes, and technologies. Contractor will collaborate with the Government Entity’s
stakeholders to document the results of the security assessment and develop the recommendations report.

1.2 PROJECTPURPOSE / OBJECTIVES

(Identify the key end results that the project will achieve when successfully executed. Measurable performance indicators for
anticipated benefits may also be listed here.)
We are seeking a Cyber Security Services Contractor to provide a Risk Assessment for our Governmental Entity.

1.3BUSINESSPROCESSES IMPACTED
(Review major changes in the way business will be conducted once the project is complete (if any).)
Entity specific detail should be provided here.

1.4CUSTOMERS / END USERS IMPACTED

(Identify the specific groups whose work will be most affected during and after the project’s execution.)
Entity specific detail should be provided here.

1.5EXISTING SYSTEM DESCRIPTION

(Describe the background and system technology, components, interfaces, etc. that would be pertinent for the Contractor to provide
a comprehensive proposal. Clearly indicate what additional resources are supporting this system. Include what business processes
the solution supports, identify users, system products, etc.)
Your entity must provide sufficient detail on your environment and users to allow bidders to understand the
scope of your project, timeframes, risks, and other items which may result in the ability to provide accurate
costs.

2. DETAILED PROJECT SCOPE

(An Authorized User should use this section to define the tasks that the Contractor must complete under the
Authorized User Agreement. This section must describe requirements in a way that permits Contractor to
prepare a complete and accurate proposal. The Detailed Project Scope must include a list of the specific
requirements that the Contractor mustsatisfy. It must also include a listing of the Deliverables/milestones that
will become the basis for the Authorized User’s Project Plan, as well as those items that are specifically
excluded from the project scope.

If qualifications are identified by the Authorized User as “mandatory” or “minimum”, such

qualifications are deemed to be material and hence not waivable. Any Contractor proposal that does
not meet or exceed the requirement must be disqualified from consideration.)

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
2.1 PROJECTREQUIREMENTS
(List the key technical, functional and non-functional requirements for the project. Highlight the requirements that are essential to the
ultimate success of the project. Insert rows and columns as needed to provide a complete listing of these requirements (attach a
ProjectRequirements document if needed) or reference a website link to an electronic copy of this document.
 Specify project requirements clearly so that all Contractorscan understand them.
 Reference applicable specifications and standards required.
 Specify Contractor requirements and responsibilities clearly.
 Specify location where work is to be performed.
 Specify all elements of the Project Plan requested (such as Gantt chart, Work Breakdown Structure (WBS), etc.)

Examples of non-functional, non-technical requirements are administrative tasks, documentation, required meetings, etc.)
We are seeking a Cyber Security Services Contractor to provide a Risk Assessment for our Governmental Entity. This
Assessment is a priority and should be completed within four (4) weeks of notification of award, unless otherwise
agreed upon by the Governmental Entity.

Using the NIST 800.53 Top 20 Critical Security Controls:

1. Identification
a. Identity individuals who are associated with the relevant confidential/important data intended to be
secure.
b. Identify assets (hardware and software, both authorized and unauthorized) to develop baseline
inventories.
c. Review current documentation and policies for vulnerabilities and concurrence with industry best
practices.
d. Identify procedures that relate to the storage or transfer of confidential/important data.
e. Identify statutory/regulatory compliance requirements (confidentiality, privacy, security).
f. Identify core competencies & mission-critical business functions.
g. (Enter other Identification tasks as required by your entity)

2. Comprehensive Assessment
a. Interview those subjects identified previously to evaluate the strength of the Clients current controls.
b. Evaluate items a. – (g. or more) above to ensure security controls for data confidentiality, data integrity
and data availability.
c. (Enter other Comprehensive Assessment tasks as required by your entity)

3. Threat Analysis
a. Provide detailed analysis of the current security environment, including vulnerabilities.
b. Provide detailed analysis of various threat occurrences, both the potential and the impact of the threats
occurring.
c. Provide detailed analysis of the level of risks for these threats in order of highest priority.
d. Provide detailed analysis of recommended short, medium, and long-term remediation efforts to resolve
the threat.
e. Provide sufficient information for each threat to develop a scope of work to be bid out separately for
remediation of the threat including estimated effort/cost.
f. (Enter other Threat Analysis tasks as required by your entity)

4. Report and Presentation

a. Provide a detailed comprehensive Security Assessment Report consisting of all findings identified
above and recommended solutions.
b. Provide a presentation to the Client of the Security Assessment Project including detailed project
recommended solutions.
c. Provide a report for information sharing with other state/municipal entities for lessons learned/grouped
remediation efforts.
d. Provide a gap analysis of current state to anticipated future state.
e. (Enter other Report and Presentation tasks as required by your entity)

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
 5. Independent Verification and Validation Efforts (These are optional services to include should your agency
require them)
a. Assist with creation of scope of work to procure remediation services.
b. Assist in evaluation efforts as required by your entity.
c. Assist in onboarding a remediation services vendor.
d. Perform gap analysis review with the governmental entity on an as-needed basis to ensure correction
of threats within the allotted timeframe / budget.
e. Perform analysis identified in numbers 1 – 4 as required to ensure threat elimination.
f. (Enter other IV&V tasks as required by your entity)

2.2 PROJECT CONSULTING KEY PERSONNEL REQUIREMENTS

(An Authorized User may list the key personnelfunctionsand qualifications required for the project. Highlight the personnel
requirements considered to be essential to the success of the project. Insert rows and columns as needed to provide a complete
listing. Consider adding a Functions/Personnel Requirements Spreadsheet for Contractors to use in their response to ensure
consistency in Contractor responses. Each Contractor has a NYS Price List that contains job titles, descriptions and rates. The
Contractor may propose titles from their price list based on the individual Contractor’s solution for your project needs. If the positions
required are not included on a price list, Contractors may update their price list in accordance with the OGS Centralized Contract
terms to accommodate the Mini-Bid process. All positions listed as “key personnel” are expected to work the entire Authorized User
Agreement duration, unless otherwise negotiated and approved by the Authorized User in accordance with the OGS Centralized
Contract terms. Please refer to the OGS Centralized Contract and/or the How to Use this Contract document for additional details.)

JOB FUNCTION / DESCRIPTION REQUIREMENTS KEY

PERSONNEL
Audit Staff Certified Public Accountant (as required)
Threat Identification and Security Analysis SANS Certified or equivalent
           

2.3PROJECTDELIVERABLESNARRATIVE
(Provide a general description of the project included within this Mini-Bid with anticipated stages, timeframes and completion factors.
A Deliverable shall not be set forth as a status report, meeting attendance, a block of staff hours, or an invoice.)
(Your Agency) requires comprehensive cyber security audits to ensure the safety and confidentiality of our environment
and the data it contains. (Your Agency) is seeking qualified and experienced organizations to provide these services on
an expedited basis. It is anticipated the organization awarded this project will continue as part of an Independent
Validation and Verification effort to ensure full integration of the remediation efforts.

2.4PROJECTDELIVERABLES
(In the table below, list the suggested Deliverables that have been specifically included in this project. Deliverables should be clearly
linked to the requirements identified in section 2.1.If there is a chance that the Deliverable will need to be updated at a later time, be
sure to put language in the requirements that states that the Contractor is responsible for updating the document as needed. The
final list of Deliverables and timeframes will be subject to the final negotiation process; however, there cannot be material and
substantive changes tothe original scope of the Mini-Bid.Knowledge Transfer requirements should be identified for all Projects.The
final list ofDeliverables and timeframes will be subject to the final negotiation process.)
DELIVERABLE NOTES
1. Project Plan Awarded Contractor will host a kickoff meeting intended to review the
goals, approach, scope of services, and deliverables in the Statement of
Work. At this meeting the awarded Contractor will present a project plan
that describes the tasks, resources involved, and project timeframes for
each deliverable.
2. Vulnerability Assessment Report Awarded Contractor will summarize their findings, including but not limited
to security risks, threats and vulnerabilities. These findings shall be
presented in a Vulnerability Assessment Report.

3. Recommended Solutions Report Awarded Contractor will deliver reports listed in Section 2.1 number 3,
prioritizing the list of recommended solutions aligned to the NIST
framework.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
4. Reports and Presentation Awarded Contractor will deliver required reports and presentations listed in
Section 2.1 number 4.
5. Independent Verification and Awarded Contractor will complete efforts as dictated by the approved
Validiation Efforts Authorized User agreement.

2.4.1ACCEPTANCE PROCESS AND CRITERIA

(The Authorized User should include its process(es) and criteria for reviewing and approving deliverables. If no acceptance processis
set forth, the terms set forth in Appendix B control.)
Each deliverable will be reviewed and approved by (your agency) CISO or equivalent. If not approved, deliverable will
be returned for correction. A maximum of 5 business days will be allotted for correction and resubmission.

2.5 PROJECT RISK ASSESSMENT

(Identify known risks and mitigations. Consider developing a High, Medium, Low or other quantifiable/qualitative risk ranking
system.)
KNOWN RISK SUGGESTED MITIGATION STRATEGY (IF KNOWN)
Funding has been allotted for the 16/17 State fiscal year. All work on Project Requirements 1 – 4 of Section 2.1
should be completed by March 1, 2017.
           

2.6 AUTHORIZED USER SECURITY REQUIREMENTS

( An Authorized User should use this section to specify background check requirements, confidentiality Non-Disclosure requirements
and additional security or confidentiality requirements regarding access to sensitive data, such as Federal tax information, health
information, criminal justice information or education information.)
As required by (your entity).
NDA suggested

2.7 AUTHORIZED USER INSURANCE REQUIREMENTS

(An Authorized User must use this section to specify any additional insurance requirements, for this Mini-Bid, to supplement the
insurance required by the Centralized Contract. Higher insurance limits, additional endorsements and/or the availability to purchase
more than one year of tail coverage for any claims-based insurance policies must be included in this section.)
As required by (your entity).

3. GENERAL TERMS AND CONDITIONS

3.1 DEFINITIONS
(Please use this section to list any terminology, abbreviations, programs, etc. that are not included in the OGS Centralized Contract.
Definitions provided here must not modifyor conflict with definitions in the OGS Centralized Contract.)
As required by (your entity)

3.2MINI-BIDWITH STATEMENT OF WORK DOCUMENT AND ATTACHMENTS

(Authorized User should provide a list of the documents that compose the Mini-Bid. Please list all Appendices, Exhibits and
Attachments by name. Sample Language: This Statement of Work is comprised of the following:)
As required by (your entity).

3.3ADDITIONAL TERMS AND CONDITIONS

(In accordance with Appendix B, Section 28, Modification of Contract Terms, an Authorized User may add additional required terms
and conditions to this Mini-Bid and resultant Authorized User Agreement only if such terms and conditions are more favorable to the
Authorized User and do not conflict with or supersede the OGS Centralized Contract terms and conditions. Examples of additional
terms and conditions include:

 Expedited delivery timeframe;

 Additional incentives, such as a discount for expedited payment/Procurement Card use; and
 Any additional requirements imposed by the funding source.

If Authorized User is subject to the requirements of State Finance Law sections 139-j and 139-k, it must set forth its Procurement
Lobbying Law notifications in this section.)
As required by (your entity).
Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
3.4AUTHORIZED USER RESPONSIBILITIES
(The Authorized User is required to provide language regarding the respective responsibilities of both the Authorized User and the
Contractor. This listing should include, but is not limited to, expected Authorized User resources and management involvement,
responsibility for other Contractors and the Contractor’s performance, compliance with Authorized User policies, regulations and/or
laws, consents necessary from third parties, etc..)
As required by (your entity).

3.5AUTHORIZED USER DISPUTERESOLUTION PROCEDURE

(The Authorized User is required to provide language regarding theAuthorized User’s Dispute Resolution procedures.In the event
that an Authorized User does not have a Dispute Resolution policy, please refer to OSC or OGS dispute resolution policy for
guidance in creating a policy.)
As required by (your entity).

3.6ENHANCEMENT BUDGET PROVISION

(The Authorized User may provide for an Enhancement Budget provision. If an Enhancement Budget provision is not included, it
will not be available under the final Authorized User Agreement. The provision cannot exceed 10% of the total project cost.This
figure is applied after the negotiations with Tentative Awardee and should not be included with the Contractor’s submission in
response to this document. The total cost including the Enhancement budget may not exceed the Lot parameters from which the
award was made. Specific criteria and methods of reimbursements for the enhancement budget should be included in this section.)
10% provision allowed.

3.7TRAVEL
(If determined to be necessary by the Authorized User, the Authorized User may authorize the Contractor to submit a proposal that
seeks separate reimbursement for travel expenses. If so, the Authorized User must state the forms and conditions of travel that will
be considered for reimbursement, i.e. travel, lodging, meals, per diem, etc. All rules and regulations associated with this travel can
be found at http://osc.state.ny.us/agencies/travel/travel.htm. In no case will any travel reimbursement be paid that exceeds these
rates. All travel must be included in the Mini-Bid response. Travelshall be paid only in conjunction with a Deliverable specified within
the Authorized User Agreement and must be billed with that associated Invoice with receipts attached. If travel reimbursement is not
necessary, please delete the travel line from financial template.)
As required and approved by (your entity).

3.8 RETAINAGE
(An Authorized User may include a provision to retain a percentage of each individual Deliverable payment of no more than 20%
until the acceptance of the complete Deliverable or project. Additionally, the Authorized User may include a provision that retainage
may be reduced when the Contractor substantially reduces the agreed upon deliverable timeline. The Authorized User must include
the requirement for retainage, the total percentage of retainage to be withheld, and the potential reduction from the withhold in this
area.
The use of retainage, the retained percentages and timing for release employed is at the discretion of the Authorized User within the
limits listed in the preceding paragraph. An Authorized User may negotiate with a Tentative Awardee with regard to retainage if
retainage is included in the Mini-Bid.)
As required and approved by (your entity).

3.9 ADDITIONAL INCENTIVES

(An Authorized User may include an invitation to Contractors to propose additional incentives, such as a better offer from the OGS
Centralized Contract (see Appendix B Section 28) or an enhanced offer related to the Authorized User specific terms, for
example:security terms or the retainage.)
As allowed for by (your entity).

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
 CONTRACTOR RESPONSE TEMPLATE
Contractor: When the Authorized User provides for electronic submission, please convert this executed document to PDF,
attach this PDF with the Contractor’s full submission, and e-mail before the Mini-Bid Deadline.

The Contractor Submission must be fully and properly executed by an authorized person.  By signing you
certify your express authority to sign on behalf of yourself, your company, or other entity and full knowledge
and acceptance of this Mini-Bid (including any Questions/Answers or addendums), the OGS Centralized
Contract and that all information provided is complete, true and accurate. 

(Where Procurement Lobbying Law is applicable by the Authorized User, by signing, Contractor affirms that it
understands and agrees to comply with the Authorized User’s procedures relative to permissible contacts.  Information
may be accessed at:Procurement Lobbying:  http://www.ogs.ny.gov/aboutOgs/regulations/defaultAdvisoryCouncil.html )
The Authorized User will not be held liable for any cost incurred by the Contractor for work performed in the
preparation of a response to this Mini-Bidor for any work performed prior to the formal execution of an
Authorized User Agreement. Responses to the Mini-Bidmust be received as specified in Key Dates and
Events. Contractor assumes all risks for timely, properly submitted deliveries of this Mini-Bid response. A
Contractor is strongly encouraged to arrange for delivery of Mini-Bid responsesprior to the date of the bid
opening. LATE MINI-BID RESPONSESmay be rejected. The received time of Mini-Bid responseswill be
determined by the clock at the Authorized User’s location.

Contractor’s Federal Tax Identification Number

(DoNot Use Social Security Number) Contractor’s NYS VendorIdentification Number

           
Legal Business Name of Company Responding (must match the OGS Centralized Contract):
     
D/B/A –Doing Business As (if applicable):
     
OGS Centralized Contract Number:
     
Contractor’s Signature: Printed or Typed Name:
     
Title: Date:
           
 CONTRACTOR DECLINES TO RESPOND TO THE MINI-BID for the following reasons:
     
 Insurance Affirmation: All insurance forms as per Lot requirements, , have been provided to OGS and are up to
date.
 Additional Incentives
     

The information in this document defines the Authorized User’s Project and its scope. The
Contractor is to return a project plan and financial submission based on the above
information. The Contractor’s response to this Mini-Bid should address all elements
included within the Mini-Bid, following the order listed in this document. No extraneous
elements or enhancements are to be included.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
 INDIVIDUAL, CORPORATION, PARTNERSHIP, OR LLC ACKNOWLEDGMENT

STATE OF       }
} SS.:     
COUNTY OF       }

On the     ______day of      ____________________ in the year 20   __, before me personally appeared      ____________________, known
to me to be the person who executed the foregoing instrument, who, being duly sworn by me did depose and say that _hemaintains an office at      
________________, and further that:

[Check One]
☐ If an individual): __he executed the foregoing instrument in his/her name and on his/her own behalf.
☐ If a corporation): __he is the      _____________________ of      ____________________, the corporation described in said
instrument; that, by authority of the Board of Directors of said corporation, __he is authorized to execute the foregoing instrument on behalf of
the corporation for purposes set forth therein; and that, pursuant to that authority, __heexecuted the foregoing instrument in the name of and
on behalf of said corporation as the act and deed of said corporation.
☐ If a partnership): __he is the      _____________________ of      ____________________, the partnership described in said
instrument; that, by the terms of said partnership, _he is authorized to execute the foregoing instrument on behalf of the partnership for
purposes set forth therein; and that, pursuant to that authority, _he executed the foregoing instrument in the name of and on behalf of said
partnership as the act and deed of said partnership.

☐ If a limited liability company): __he is a duly authorized member of      _________________ LLC, the limited liability company
described in said instrument; that _he is authorized to execute the foregoing instrument on behalf of the limited liability company for purposes
set forth therein; and that, pursuant to that authority, _he executed the foregoing instrument in the name of and on behalf of said limited
liability company as the act and deed of said limited liability company.

________________________________________________
Notary Public
Registration No.

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)
The following is an example of all elements that must be included in a Contractor’s financial submission document.
MINI-BID FINANCIAL SUBMISSION
Each deliverable is to include specific title(s) with cost information. Each title must be sub-totaled. Each fixed-price
deliverable must be sub-totaled. A maximum anticipated price for travel costs per deliverable must be provided with back-
up to be included in the narrative for each deliverable. All deliverables must be totaled to a final fixed price for evaluation
purposes for the Project. Travel Costs must be detailed within the Project Deliverable narrative. Responses which include
pricing in excess of the “maximum Not-To-Exceed price” shall be rejected by the Authorized User.

Total Cost For Evaluation Purposes $ 44,900.00

Deliverable Number 1 Deliverable Name: Business Requirements Document for Application ABC
Total
Deliverable
NYS Not to Cost
Total Exceed Mini-Bid (excluding
Title Description Hours Contract Price Price Sub Total Travel)
Sample Worker Business Analyst 50.00 $ 30.00 $ 27.00 $ 1,350.00
Sample Worker 2 Senior Business Analyst 50.00 $ 50.00 $ 45.00 $ 2,250.00
$ -
$ - $ 3,600.00
Total Billable Fixed-Price Deliverable Cost (excluding Travel) $ 3,600.00
Maximum Anticipated Travel Costs Associated with this Deliverable $ - $ -
TOTAL BILLABLE FIXED-PRICE DELIVERABLE COST + MAXIMUM ANTICIPATED TRAVEL COSTS $ 3,600.00

Deliverable Number 2 Deliverable Name: Functional Requirements Document for Application ABC

SAMPLE
Total
Deliverable
NYS Not to Cost
Total Exceed Mini-Bid (excluding
Title Description Hours Contract Price Price Sub Total Travel)
Programmer 1 XML Development 100.0 $ 90.00 $ 75.00 $ 7,500.00
Programmer 2 C++ Development 100.0 $ 120.00 $ 100.00 $ 10,000.00
$ -
$ - $ 17,500.00
Total Billable Fixed-Price Deliverable Cost (excluding Travel) $ 17,500.00
Maximum Anticipated Travel Costs Associated with this Deliverable $ 1,000.00 $ 1,000.00
TOTAL BILLABLE FIXED-PRICE DELIVERABLE COST + MAXIMUM ANTICIPATED TRAVEL COSTS $ 18,500.00

Deliverable Number 3 Deliverable Name: Deployment of Application ABC Into Test Environment
Total
Deliverable
NYS Not to Cost
Total Exceed Mini-Bid (excluding
Title Description Hours Contract Price Price Sub Total Travel)
Trainer 1 Classroom Training 40 $ 25.00 $ 20.00 $ 800.00
Project Manager Lead 100 $ 250.00 $ 200.00 $ 20,000.00
$ -
$ - $ 20,800.00
Total Billable Fixed-Price Deliverable Cost (excluding Travel) $ 20,800.00
Maximum Anticipated Travel Costs Associated with this Deliverable $ 2,000.00 $ 2,000.00
TOTAL BILLABLE FIXED-PRICE DELIVERABLE COST + MAXIMUM ANTICIPATED TRAVEL COSTS $ 22,800.00

Group 73600 Award 22772 Project Based Information Technology Consulting Services (Statewide)